OSEP Study Plan

Evade EDR, breach hardened defenses, and build your own tooling. A free, day-by-day OSEP schedule built from the official PEN-300: Evasion Techniques and Breaching Defenses syllabus, scaled to your exam date and weekly hours.

Approx. cost: $1,749–$2,749
Difficulty: ♥♥♥♥♥
Study time: about 234h
Start level: Advanced

▶ Build my OSEP plan

> How long does OSEP take?

The plan assumes about 234 study hours. Here is how that stretches across different weekly schedules.

Hours per week	Time to finish
5 hours	about 47 weeks (10.9 months)
10 hours	about 24 weeks (5.5 months)
15 hours	about 16 weeks (3.7 months)
20 hours	about 12 weeks (2.8 months)
30 hours	about 8 weeks (1.8 months)

> OSEP exam format

OffSec · PEN-300: Evasion Techniques and Breaching Defenses

48-hour proctored exam
Realistic corporate network with multiple hardened machines
Requires adapting or building custom tooling, not just running exploits
PEN-200 / OSCP-level experience required beforehand
24h report submission after the hands-on portion

Official OSEP page ↗

> OSEP syllabus and study hours

Every topic in the plan, in order, with its baseline hours. The planner shrinks or stretches these to fit your dates.

Weaponization Fundamentals

Build a foothold with client-side code execution.

Operating System and Programming Theory8h · learn
Client-Side Code Execution with Office8h · learn
Client-Side Code Execution with Jscript6h · learn

Evasion Tradecraft

Keep your payloads alive against modern AV and EDR.

Process Injection and Migration8h · learn
Introduction to Antivirus Evasion6h · learn
Advanced Antivirus Evasion10h · learn
Application Whitelisting6h · learn
Bypassing Network Filters6h · learn

Post-Exploitation & Credentials

What to do once you're on the box.

Linux Post Exploitation6h · learn
Windows Post Exploitation6h · learn
Kiosk Breakouts4h · learn
Windows Credentials8h · learn

Lateral Movement & Domain Exploitation

Move through the network and take the domain.

Windows Lateral Movement8h · learn
Linux Lateral Movement6h · learn
Microsoft SQL Attacks6h · learn
Active Directory Exploitation10h · learn
Combining the Pieces8h · learn
Trying Harder8h · learn

Challenge Labs

Full-engagement simulations that mirror the exam.

Official Challenge Labs60h · lab
Extra evasion practice20h · lab

Final Boss Prep

A toolkit, a report, and a full-length dry run.

Build an evasion + AD toolkit cheat sheet8h · review
Write a full report from one challenge lab6h · review
Timed 48-hour mock exam12h · review

> Where to practise for OSEP

Each task in your plan lists practice labs for its own topic. These are the best places to put in extra hands-on hours:

GOAD: build your own multi-forest AD lab (GitHub)
Pro Labs (enterprise-style networks) (Hack The Box)
Red Teaming path (TryHackMe)

> OSEP exam-day checklist

General logistics for exam week. The official exam guide always takes priority if it differs.

One to two weeks before

Schedule your exam and add the start time, time zone and deadline to your calendar
Read the official exam guide end to end: rules, allowed and banned tools, and what counts as proof
Test your evasion tooling against a fresh, fully patched Windows build
Keep custom tooling source and build steps in your notes
Complete a full-length timed practice run (48 hours if you can) on your exam setup
Finalize your note-taking setup and templates (see the notes starter below)
Build and review your cheat sheets and command references
Arrange time off, tell people you will be unavailable, and plan your meals ahead
Check your ID is valid and matches the name on your exam account

Machine and network

Charge and test a backup device or phone hotspot, and know how to contact support if your connection drops
Plug in your laptop and turn off sleep, updates and notifications for the exam
Test the VPN or lab connection early and know how to reconnect after a drop
Update your attack VM, take a clean snapshot and keep a spare
Install and test every tool you plan to use, and check none of them are banned
Test your screenshot hotkeys and make sure you have plenty of free disk space

Proctoring and room

Test your webcam, microphone and screen sharing on the proctoring platform
Clear your desk and room as the rules require, and tell housemates not to interrupt
Confirm what is allowed at your desk (second monitor, phone, notes, paper) and follow it exactly
Learn the rules for breaks and for leaving the camera view
Have your ID ready and know the check-in steps

During the exam

Sleep well the night before, and skip last-minute cramming
Prepare food and water, and set timers for break reminders
Read the brief and scope carefully before you touch anything
Write notes and capture proof as you go, not at the end
Time-box each target and move on when stuck. You can come back later
Stop new attacks with enough time left to verify your evidence

Report and submission

Copy your report template and fill in the easy parts (scope, methodology) while you work
Check every finding has reproducible steps and screenshots
Proofread: could someone else follow each step?
Export in the exact format and naming the exam guide requires
Submit with a buffer before the deadline and confirm it was received

Suggested exam-day rhythm

Hour 0 to 1. Connect, confirm the VPN, read the brief, set up your notes and plan the first day.
Day 1. Enumerate everything, then go after the most promising targets in 90-minute blocks with short breaks.
1 sleep window. Plan 6 or more hours each night. Write down where you stopped and your next three ideas before you sleep.
Meals and movement. Eat proper meals away from the desk and walk outside at least once a day.
Last 5 hours. Stop new attacks, verify evidence and outline the report while everything is fresh.
After the hands-on part. Write the report in focused blocks, proofread, and submit with a buffer before the deadline.

▶ Open the interactive OSEP exam kit

The kit lets you tick items off, download a notes starter and report template, and see a readiness score from your plan progress.

> Passed OSEP with PWN PATH

No OSEP debriefs yet

Passed a cert? A short debrief helps the next learner plan their own run, and it only takes a couple of minutes.

▶ Share my debrief

Debriefs are self-reported. See all pass stories.

> Frequently asked questions

How long does it take to prepare for OSEP?

PWN PATH builds the OSEP plan on about 234 study hours. At 10 hours a week that is roughly 24 weeks, and at 20 hours a week roughly 12 weeks. Your own timeline depends on how much of the material you already know.

What is the OSEP exam like?

48-hour proctored exam. Realistic corporate network with multiple hardened machines. Requires adapting or building custom tooling, not just running exploits. PEN-200 / OSCP-level experience required beforehand. 24h report submission after the hands-on portion.

How hard is OSEP?

We rate OSEP 5 out of 5. It suits experienced pentesters who want to beat modern defences and EDR. OSCP-level experience is expected before you start.

How much does OSEP cost?

OffSec bundles start around $1,749 (course, 90 days of labs, one exam attempt); Learn One is about $2,749 per year with two attempts. Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.

What should I study first for OSEP?

Start with the "Weaponization Fundamentals" phase: Operating System and Programming Theory, Client-Side Code Execution with Office, Client-Side Code Execution with Jscript. The planner puts topics in a sensible order and scales the hours to the time you have.

What are the prerequisites for OSEP?

OSCP-level experience is expected before you start.

What should I do the week before the OSEP exam?

Re-read the official exam guide for rules and banned tools, test your machine, network and VPN or lab connection, finish a full timed practice run, finalize your notes and cheat sheets, and plan your meals, breaks and sleep. The exam-day checklist on this page covers it step by step.

How should I handle breaks and sleep during the OSEP exam?

Hour 0 to 1: Connect, confirm the VPN, read the brief, set up your notes and plan the first day. Day 1: Enumerate everything, then go after the most promising targets in 90-minute blocks with short breaks. 1 sleep window: Plan 6 or more hours each night. Write down where you stopped and your next three ideas before you sleep. Meals and movement: Eat proper meals away from the desk and walk outside at least once a day.

What should I take after OSEP?

OSEP is one of the furthest steps in its track. The roadmap shows related certs in other tracks.

Is the PWN PATH study planner free?

Yes. There are no accounts and no sign-up. Your plan and progress are saved in your browser, and you can export a backup file, add the schedule to your calendar or print it.

> Plan your path

Good stepping stones before OSEP: